CVE-2022-2969
High
Description
Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.
SeverityHigh
CVSS8.1
Exploit probability—
ProductDeltaww Dialink
PublishedDec 1, 2022
First seenDec 1, 2022
Weakness typeCWE-22Path traversal
How to fix
Update
- deltaww dialink1.5.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| deltaww dialink | v < 1.5.0.0, 1.5.0.0 | 1.5.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.